Opensc EUVD-2025-209124

This vulnerability presents low-to-moderate real-world risk despite a CVSS score of 3.8 (low). The CVSS vector AV:P (physical attack vector) and AC:H (high complexity) indicate significant barriers to exploitation-an attacker must have hands-on access to the victim's computer AND craft a malicious token, AND the victim must actively use the token at that exact moment. The UI:R (user interaction required) further restricts the threat window. However, the severity is elevated by the fact that targets are likely high-value (users with smart cards or hardware tokens), and the impact extends across confidentiality, integrity, and availability (C:L, I:L, A:L). EPSS data is not provided, but the combination of physical access requirement and high complexity suggests exploitation probability remains low. SSVC analysis would likely classify this as defer-acceptable for enterprise environments where token usage is controlled and monitored, though it warrants patching as part of routine security updates. The patch availability (version 0.27.0) and the absence of public exploit code reduce urgency, but critical infrastructure or high-security environments relying on smart card authentication should prioritize remediation.

An attacker with physical access to a user's workstation crafts a malicious USB smart card reader or token that, when the legitimate user inserts and uses it, sends specially crafted APDU responses to OpenSC. The stack buffer overflow is triggered during the GET RESPONSE processing, potentially allowing the attacker to corrupt the stack frame and overwrite return addresses or sensitive data. Success depends on the attacker being present at the exact moment the authorized user accesses the token, making it suitable for targeted attacks against high-value targets or supply-chain compromises where the malicious device is pre-planted. No public proof-of-concept has been identified.